CVE-2026-71497: 
Java vulnerability analysis and mitigation

CVE-2026-71497 is a cross-site scripting (XSS) vulnerability in jsoup, a Java HTML parsing and sanitization library. The flaw affects jsoup versions 1.14.3 through 1.22.2 (inclusive) and was disclosed on July 30, 2026, with the GitHub Advisory Database entry published on August 6, 2026. When a custom Safelist permits certain raw-text elements, jsoup's HTML parser may incorrectly handle malformed tag names ending in a control character, causing sanitized content to be emitted as active markup rather than inert text, potentially enabling XSS. jsoup's built-in Safelists are not affected. The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (Github Advisory, jsoup Advisory).

The root cause is improper handling of control characters in tokenizer tag names (CWE-79). jsoup's tokenizer normalized tag names using trim(), which silently stripped trailing control characters from tag names. This caused a tag such as template to be treated as template during tree building, adopting the parsing behavior of the template element — a raw-text element — even though the source tag was not actually a template. The fix (commit 92f1aca) changes the tokenizer to use lowerCase() without trimming, so control characters are preserved in the token and the resulting Tag remains consistent, preventing raw-data content from being exposed as markup during serialization. Exploitation requires that an application uses a custom Safelist that explicitly permits raw-text elements (e.g., style, script, textarea) and passes attacker-controlled HTML through jsoup's Cleaner (jsoup Advisory, Fix Commit, Issue #2538).

Successful exploitation allows an attacker to inject active HTML markup — including JavaScript — into content that was expected to be sanitized, resulting in cross-site scripting. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of a victim user, or further client-side attacks. The scope is changed (C:L, I:L per CVSS), meaning the impact crosses the security boundary of the sanitizing application into the victim's browser context. Availability is not directly impacted (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity — specifically, the target application must use a custom jsoup Safelist that permits raw-text elements, and a victim user must interact with attacker-supplied content (Github Advisory, jsoup Advisory).

1. Identify a vulnerable target: Find a Java web application that uses jsoup versions 1.14.3–1.22.2 with a custom Safelist that permits raw-text elements such as style, textarea, or similar tags to sanitize user-supplied HTML.
2. Craft malformed HTML: Construct an HTML payload containing a tag name that ends in a control character (e.g., ``) followed by content that would be harmful if interpreted as markup — for example, <style>...</style> with embedded script-like content.
3. Submit the payload: Inject the malformed HTML into an input field or parameter that is processed by jsoup's Cleaner with the permissive custom Safelist.
4. Trigger misparsing: jsoup's tokenizer strips the trailing control character via trim(), causing the tag to be recognized as a known raw-text element (e.g., template), which alters its parsing behavior so that its content is treated as raw text during parsing but emitted as active markup during serialization.
5. Achieve XSS: The serialized, "sanitized" output contains active markup. When a victim user views the page rendering this output, the injected script executes in their browser, enabling session theft, credential harvesting, or other client-side attacks (jsoup Advisory, Issue #2538).

Upgrade to jsoup version 1.23.1, which fixes the vulnerability by preserving control characters in parsed tag names during tokenization. As a temporary workaround for applications that cannot upgrade immediately, do not permit raw-text elements (e.g., style, script, textarea) in custom Safelists used to clean untrusted HTML. Additionally, note that even after patching, permitting raw-text elements in a custom Safelist does not make their contents inherently safe — for example, applications permitting style must apply separate CSS safeguards, as jsoup does not parse or sanitize CSS (jsoup Advisory, jsoup 1.23.1 Release).

The vulnerability was reported by security researcher quitbug and remediated by jsoup maintainer Jonathan Hedley (jhy). The fix was included in jsoup 1.23.1, released July 30, 2026, alongside significant performance improvements and other bug fixes. No notable broader media coverage or significant community controversy has been observed beyond the standard advisory and release notes (jsoup Advisory, jsoup 1.23.1 Release).